A 6-year-old girl made $250 in Pokemon purchases despite the fact that her mother has a fingerprint-ID locked phone.

According to the Wall Street Journal, Arkansas mother Bethany Howell was taking a nap when her 6-year-old daughter, Ashlynd, used Howell’s thumbprint to unlock the phone and gain access to the Amazon app.

Ashlynd proceeded to buy 13 Pokemon items totaling $250. She fessed up when her parents thought their account had been hacked, telling them she’d gone “shopping” and that she’d gotten the shipping address right.

Because of the phone’s fingerprint sensor, Ashlynd didn’t need a PIN or password to access her mom’s phone.

Howell was able to return only four of the items, the newspaper reported. She told her daughter that Santa found out about the little shopping spree and planned to bring her Pokemon items for Christmas.

We’ve seen these types of cases before. Earlier this year, a federal judge ordered Amazon to reimburse parents whose children made in-app purchases without permission. The FTC accused the company of making it too easy to children to make unauthorized purchases in certain apps.